Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/42 Thanks!
Please welcome Peter Studi,
thank you.
All right.
Thanks, everybody.
I'm here to talk a bit about hardening
hardware and choosing a good BYLES.
Let's see what this means.
So.
Yes, what will I say, introduction, just
briefly about me hardening hardware,
why should we care about hardening
hardware? What's what's the point?
The software seems to be working fine,
right?
Um, I'm going to look at some
some well-known hardware attacks
and attack surfaces that are quite,
quite open on any machine,
really any machine today.
Let's see if we can do something about
these open attack surfaces
and look inside
a machine.
Look. Well, first of all, look at some
schematics and then look inside the
machine and see if we can make some
changes. Maybe part of,
uh, part of this is also choosing
a good BIOS pun on
the name side by us, of course.
But the point
I think the point is important firmware
is in many ways
the root of trust in our software
stack because it is the first software
that runs on the machine.
So we need to
we need to be aware of this software and.
It's not for me.
Need to be aware of also the firmware
in our machines, and maybe there's even
more software laying
around in the machine somewhere that we
don't know that we should also look at.
I will.
So for the purposes of this talk and
the work I've been doing for a while,
I consider Corbould to be the good boss.
But Corbould is
it's not focused.
I'll get to that in a bit.
It's not focused on a single platform,
but it is dominantly for eighty
six so far.
So I'm also going to maybe
take a moment
to talk about nudniks eighty-six machines
as well, because I think that they will
be more important in the future.
So I'm Peter, I moved to Sweden.
No, I moved from Sweden to Germany a
few years ago. I I'm interested and
I've been working with the software and
hardware and security for a long time,
electronics since I was a little
kid. That's that was always a lot
of fun to take things apart
and eventually put them back together
again. And I care a lot about open source
and I've done for a long time.
I think this is this is really,
really the way to go.
I guess you all agree.
I work on Corbould and
live USB
to flash from com projects and
so hardening hardware.
Why what what's what's
this. What's the problem.
So the problem is that security is
not really a market value.
Nobody is nobody is
buying millions of computers because
they are secure.
Instead, it's things like
cost or size or
battery lifetime or
screen resolution or screen size
or the number of gigahertz or the number
of megabytes or terabytes
or exabytes,
the color of the charity case, which is
or maybe the Windows version or
or and I
the last one, I admit, I did make up
the length of the included HDMI cable,
but I'm sure that some people will buy a
machine based on that as well.
So, yeah, security is not on the list
and sure, yes, there are
a few buyers
that buy machines because they are
secure, but they don't matter.
There are too few.
Someone might argue that, well, OK, I buy
a device or a system
that just works.
It just works.
Then it has to be secure
also. Right, because it is it is
really working. It's only doing
what I want it to do.
Well, actually, the systems that
function that way, that that
tend to just work, they are usually
so simplified, so simple, so
restricted that,
yes, they will do the thing
reliably that they've been designed to
do, but they may be doing other
things as well, because the only way to
ensure that these systems
really do only what they were designed to
do is to lock them down and to lock them
down hard so that you and I
can do anything with them besides
point that colorful pictures
and icons.
So how does it just work?
How does it work inside?
That's that's that's
that's what this talk is about.
Isn't the hardware hard enough?
If we if we're buying hardware,
it's a machine. Right.
It's something something physical,
something tangible. We can touch it.
It is. It is.
It is what it is when we buy it.
But.
Really, it's.
Seems to be the tendency that hardware
changes quite a lot under
its lifetime, um,
hardware is becoming softer.
In fact, there are firmware
updates everywhere for every single
device.
USB 3.0 controllers
hub's. I believe that the USB
three or the HCI standard
was finished so quickly
that, um, devices
were put on the market before they were
actually even compliant and the
compliance was made after
by designing in reprogramable
parts of these controllers with external
memory. So it's not that it was hidden or
anything, it's just that these devices
had to be finished and shipped
so quickly that they couldn't be or
they had to be shipped so quickly that
they couldn't really be finished
before they shipped even.
So hardware isn't that hard, hardware is
is pretty soft.
Feature films, my
I have a cell phone.
Some people don't because they they
don't like cell phones.
I think that's agreeable.
I do have a cell phone. I got a new cell
phone about a year ago or so.
I walked into a random store and I bought
the the simplest possible
cell phone that I could buy for the
least amount of money and
a new phone.
So it was a candy bar phone because
I like that format.
I call it a dumb phone because it isn't
a smart phone, but it still has firmware
updates, um,
RAZR patterns. How many people have had
a device ask
you to download and or install
a firmware in the last six months.
That's almost everybody
right at the moment,
we have C.P.U microscope, we've had that
even for we had that for almost
a decade.
Updates to the
actual physical process are
included in the PC.
Fermor, um,
as far as we know, introduced in
2004, is the earliest, earliest
press I saw about this for the Pentium
pro.
You remember those?
That's that's been there for a while now,
and the immediate future, I'm pretty
sure, is going to be reconfigurable
processers if they're not already
in use on the market.
I did a fun project,
uh, not so long ago, actually, just
last night
with with them
the Beagle Bone, which has a nice called
Pratico processor that
runs independently of the main processor.
And you can download a new firmware to it
and it does other magic things.
Right. So this is already exists
in some, um,
in some special cases.
But I'm quite sure that we're going to
see reconfigurable computing
explode in 10 years,
have exploded already in 10 years.
So devices aren't just hardware.
There aren't really only these physical,
tangible things that we go into a store
and buy. I mean, we do that, but they
come with a thick stack of software.
They come with a huge amount of software.
And knowing our tools is really
important if we want to do.
The best we can with these devices,
with our computers.
So my comparison here is with
Carpenters', if you have a skilled
carpenter with brilliant tools, then
they can make fantastically beautiful
carvings and furniture and so on.
And it's the same thing with software
developers. I know.
I know many software developers, software
developers are quite uncomfortable
with going into hardware and looking
at hardware and messing with hardware and
destroying hardware.
But actually that's a lot of fun, too.
I just don't inhale the smoke.
It's it's not so good for you.
It starts with starts with simple things
and and destroy them a few times and then
make make things.
It's good.
The current state is sadly
that we really don't know that much
about our hardware, the pieces
that we are using.
Today, we used to know
quite well when they were new,
but that was 30 years ago and
we haven't really been paying attention
along the way.
Meanwhile, it's just a few companies
that have all
the know, knowledge and know how.
And I don't think that's a good.
Sad face.
So I know that hard work.
How can we do that when we don't even own
the machines? I was saying
that the devices that just work,
so the ones that get popular are the ones
that sell.
They are locked down.
The iOS is a good example.
Windows art is another good example.
Android. Well, there are some Android
devices that are more locked down than
others, but it's
there are few systems that are really
both end user
devices and
open for modification.
You have to choose either or at the
moment.
Desktop laptop server PCs,
um, they're all Microsoft Windows
machines.
If you're talking to a hardware
manufacturer that manufactures laptops,
let's say they
don't think in terms of, well, this
is a hardware. This is a machine that can
run any operating system.
It can run dos, it can run windows, but
it can also run free BSD and it
can run Linux.
They think of this as this is
a Microsoft Windows
machine.
That's the purpose of this product.
It's going to run Microsoft Windows.
Anything else is an accident.
That's really that's really
that's really true, it's sad, but it is
that's the case.
Our tablets are Microsoft Windows are
machines.
All the Macs are obviously Apple OS X
machines.
And a lot of people like OS X machines
and like OS X, but
well.
It's manufactured, it's designed,
it's produced to be
only this one thing, and it's not
meant that anyone looks
into it, goes inside of it,
makes changes.
Cell phones again.
Apple iOS machines.
They made an incredible accomplishment
entering that market over Google Android
machines and Android cell phones.
That's yeah. I'm hopeful there that.
That we can actually be making some good
open based open
source systems
using those machines.
Of course, how deep does the rabbit hole
go? So there's code in the process,
as I mentioned, micro code.
The way I see it, the micro code, the
chips inside of the processor is
hardware. It's part of the hardware.
It defines how this
this processor executes instructions.
So micro code updates are hardware
as well. The way I see it, either you
trust the micro code that is in there,
and if you do, then you might as well
trust the micro code updates
or you don't trust the micro code that is
in there. And then you can't really use
that CPU and you have to.
Well, I don't know, make your own.
Perhaps there are, by the way,
a few good presentations on exactly that
topic, which I recommend that you all go
see and maybe you will like.
Making your own CPU's, please do.
There are some idealists that
who sometimes insist on removing
these microphone updates, so in Corbould,
we get we get interest from
from lots of people who think freedom is
important and who want open systems
as well.
And they say, OK,
I really want to build a core, but that
does not apply any market code
updates.
I want to run only exactly what shipped
from the manufacturer inside
the physical device.
Even though the micro code updates
fix bugs, presumably,
and, well, not only presumably they
actually do fix bugs in some cases, at
least, there are brought us together,
delivered together with them or available
for the micro code updates which describe
what what is this Microsoft update
used for or what does it do?
Sometimes the processor doesn't work
reliably without the microscope update.
What do you do then? Do you apply the
microscope updated or don't you?
Sometimes it doesn't even start
properly.
Quoting quoting one of these users or
one of these one of these users,
it's the principle of saying I am
removing part of your control
over me, as so
me being the user
of this processor and your
control being the control by the
manufacturer.
But what degree of control do we want?
So if we want to control our users and
then there's new
and other open source
operating systems,
it's a good one.
Kernel Linux, BSD firmware,
there's Corbould, Onex, Eighty-six and
Corbould on arm and other bootloader
on other platforms.
What about MicroCon?
What about hardware?
Doesn't look so good there at the moment.
But my software is running just
fine on this machine, I can take this
machine and I can install in my whatever
and run it and it works fine.
Or does it? Do you really know?
Uh, yes.
It looks like it's working fine, but
is it somehow leaking information
about your data in
a side channel, on a network interface
that you don't know how it works?
Can you can you even even have equipment
to find out
if your software is actually
running fine and doing what you want
and if the entire system is doing what
you want and nothing more?
Really, it's not so easy.
So there are lots of attacks on.
Laptops, for example,
or that are lots of attacks that are
practical for laptops.
There's an old
well documented FireWire
exploit or I.
E 30 NINETY-FOUR,
which is basically a remote memory
access bus.
It's really fast.
Um, it was designed for
hard drives, external hard drives.
And they have to be they have they need
a fast interface. So yes, of course
I attribute the 94 has to be fast.
So let's do direct memory access from the
outside.
Except if you don't restrict
where the memory accesses go then
well you can access any memory
that's not so good.
There's, um,
advanced management technology which is
built into every single intel
chips that after
well, 2005 or 2006
or so.
Every single chip that has this,
if you buy, there's a cutoff point
that I've noticed, been experimenting
between the nine forty five chipset and
the nine sixty five chipset.
So we're talking twenty six generation
hardware.
If you power on the 945 chipset
without any firmware in the boot flash,
then nothing happens.
It's it
doesn't work.
You power on the 965 chipset
without any contents in the boot flash.
There's an IPV six packet
coming out of the at port.
That was 2006.
So check out Patric's talk about
Stephen, he's doing it.
OK, I think it is tomorrow or maybe the
day after tomorrow about his
work on active
advanced management technology.
It's really interesting
and it's a serious attack vector.
So someone on your network
can access whatever
your network interface can access.
P is three, so there was a USB fuzzing
attack against the PlayStation three,
the guys talked about that a few years
ago here and other places
we know about bio's boot kits.
You get some kind of bad software into
your system.
It rewrites
the flash memory, the boot flash and
stores some kind of
persistent version of itself there.
So it it stays in your
system once it's gotten in.
We can summarize this by saying
that systems can be influenced
simply by injecting data in
many different ways on
many different standardized interfaces,
and we get results from
just application denial-of-service where
things don't work, they crash or whatever
to actual kernel code execution or
even worse, direct memory access.
So that's stage one.
That's something someone can do.
If they pass by your computer for a few
seconds, they can connect something
and they can read your memory
in the machine.
Several different ways to do this already
demonstrated. Some of them have had
protections published and implemented,
and that's good.
Mhm. But it's still a big risk
I think, and not all of them have
been looked at in great detail
and it's not so easy to look at them in
great detail because these are closed
systems. They aren't meant to be
looked into actually.
So commodity machines,
commodities systems, they have lots of
black surfaces, there
are several DMA interfaces
exposed to the outside world
offering up private key material and
whatever you have, whatever else you have
inside the machine, the
FireWire that I truly 394,
if you have a laptop, maybe you have a
card bus slot.
If you have an old laptop like I do, or
maybe you have an express card slot,
which is PCI Express.
So even faster access to your private
keys.
PCI, PCI Express on my
on this machine, I can't do it that
easily, but on I have a
small netbook also where I lose and I
take a few screws and the entire backside
comes off.
It's convenient because I can replace the
wireless networking card.
It's also convenient for an attacker who
wants to replace my
wireless networking card.
The wireless networking card, which, by
the way, is a radio interface which is
connected to the PCI bus.
So this is a radio transmitter
and receiver which is connected to
your memory bus?
My memory bus.
Well, not the memory of us, but it can
access the memory on its own,
all devices, all PCI Express devices,
they can be Bushmasters, they can
say to the chipset that,
hey, I want to read from memory now.
And they get the memory contents, it's
really easy for them and OK, so,
yeah, this this
radio, this wireless networking card.
Um, it only
implements the standardized wireless
networking protocols, right?
Well, you know,
I don't.
I don't I saw, um.
I saw something about, oh, right, yes,
no, now I forgot his name again, Musila
is a guy I met in
Berlin in May this year.
He wrote a master's thesis on it on
this advanced management technology also
several years ago. So, um,
on older versions of that hardware.
And he found that actually sometimes
that's enabled over wireless network as
well.
So the wireless network greeting card
will connect to an access point
all on its own and.
This is the card that is connected to
your memory box,
docking station, connector, Ethernet,
Ethernet needs to be fast as well.
So it's also on the PCI Express bus.
Right.
And the docking station as well has lots
of expansion capabilities and it
has fast peripherals.
So also a direct memory access LTC
is a low pin
count for
four pins used to replace
the ESSABAR that nobody wants to have
anymore, used for slower devices.
But it's also available on the docking
on the docking station of this machine.
So what other so this is this is
these are the serious problems.
These are the problems that allow someone
to connect and just read memory
like that right away.
So we need to do something about those if
we want to have a chance at
hardening this machine that we have.
Uh, there are, of course, other ways to
get data into the system and try to mess
with the software that is interpreting
the data that you send. You can try
the hard disk interface I saw
at, um, uh,
Watchem this year,
someone implementing their own firmware
and on harder and harder road controller,
replacing data getting sent back to the
whole system. So you can do that
apparently easily enough.
Um, USB is a good way to send
data into any system.
Well, except so.
Since I've done a bit of work with Use B,
uh, I also know
that the use B, the way
they use, the way the USB specification
is built, it's
it's quite a thick already a thick
specification and that well, um,
that might be worrying, but it's it's
narrow. So it's fairly easy to actually
read all the code and
read the entire specification and
understand how this should work
and see that the code check
that the code doesn't do anything else.
And Colonel, U.S.
code doesn't have to deal with
the data. The data goes directly to
userspace. If it's a userspace
driver that is talking to the
USB hardware or of course,
it goes into the kernel driver if it's
kernel driver talking to the USB.
All graphic sports, B.J., DVI,
HDMI, they have a back channel for the
display ID, so
the display can say like we had
with the Beamer here, I support these
resolutions.
Which one do you want to use?
Pick one.
This is a nice square seabass usually,
and if you have a
system with a COL mode setting briber,
the current remote setting driver,
the driver runs in the kernel, reads this
data and interprets the data
structure. So is that perhaps
an attack vector as
well? Two pins on the BGA
connector and the microphone.
So if if the microphone can pick
up, um, ultrasonic
frequencies, then you can
send, of course, in audible
commands to the computer or whatever.
I don't know, to the processor that runs
micro code that
you don't know that we
don't know that.
I don't know what it does really.
Maybe it responds to this, this
ultrasonic
sound stream that is being played
by a speaker in the next room.
What can we do to to get rid of some of
the worst problems?
At least we can disable the DMA
interfaces. We can try to disable the
human interfaces. We need to try to
disable the DMA interfaces if we want
this machine to be a little bit more
resilient.
The wi fi needs to go.
We can't have a radio transmitter with
direct memory access, just no way and
ideally the Internet as well, unless you
always connect to trusted networks like
here at the Congress.
FireWire somehow disabled cardboards as
well would be good, um,
step to look at source code for
problems with just malformed
data. You would think that programmers
would know how to actually
interpret data by now.
But it seems that we don't yet
and maybe never will.
I hope that we will, but who knows?
So we have to look at the source code and
check that. Actually, the data that we do
allow into the system, it doesn't have
very many problems.
It doesn't have any problems that we can
find. Ideally, it doesn't have any at
all. Step three, choose a good bias
and step forward.
Protect the good flesh.
So in doing that, we would have
we would have a machine, we have a
machine that
is resilient to boot kits
because the Fache can't be reprogramed.
We have taken out the microscope
code if we're worried about that.
We've audited all the source code that
is running on firmware level, on
colonel level, because we all read the
colonel every day.
Right.
And UserSpacE, the
server is a good read.
And
disabled medium interfaces, so I tried
to do this, I know
I didn't try to read all of the kernel
and I didn't try to read all of the
exurbia, but I tried to read some code
and I tried to choose a good bias
and I tried to disable the DMA
interfaces.
So step three, they're choosing a good
bias I went with.
But there aren't very many options.
And I know Corbould.
So the choice was easy.
Corbould runs well on.
I'll get back to that on many systems.
But in this case, I chose one particular
system. I think PADDs where
it where it runs well enough.
I don't know if you recognize this quote,
it's it's commonly
used by Dave Jones
of the blog dot com, it's a good
it's he's a fun guy,
so don't turn it on.
Take it apart.
Let's see.
So this is let's start with
the description of the machine.
If you look around the Internet, you can
find schematics of
all sorts of.
Schematics of all sorts
on all kinds of sites, and this
this is the first page, the overview,
the block diagram of this laptop,
I assumed into
to the interesting parts,
the most interesting part.
So the iso h7 that's the chipset.
And I don't know if it is readable.
Yeah, it's it's pretty readable.
It has a bunch of interfaces
listed there. The line, the
ultra, the parallel to the simulator
LPC that we mentioned, the PCI,
the PCI Express and
um these connect.
So at the top we have this Ricoh
chip which is driving
as we see to the well to
the left eye Tripoli
and to the right PCMCIA
slot and cardboards.
It says PCMCIA in the schematic
but it's carbos. PCMCIA wouldn't have
been quite as bad because it's the 16 bus
without as far as I've seen,
without direct
memory access. But Cardboards is is
quite a bit more because Karbasi is a
proper PCI bus, just not pluggable.
And the RICO trip is just a PCI
to PCI bridge, so
that's problematic, we need to do
something about that.
We have we see that the
mini PCI Express
w w well
w one card with one card,
the three G is is
underneath it, that's connected over USB.
And in order to have any kind
of connectivity I and because
I know USB well and I've looked at a lot
of the USB code, I decided that well
I think it was B is OK,
I'm going to allow USB
still there, otherwise
there's really no way I can get anything
in or out of the machine.
As it turns out,
the the Wi-Fi card that has to go
the
the built in Ethernet is also on PCI
Express.
So someone could walk by
and send a magic packet or,
I don't know, talk to the advanced
management engine somehow or the
management engine over Ethernet and
do things to my machine if
I leave it around, I don't like that.
Looking a little bit further down,
there is a keyboard controller and
Ralph Lineman, he talked about that
particular controller a few years ago,
and that is also was also one of
the inspirations for this talk.
This keyboard controller can can, of
course, record all your keystrokes and it
can send them out in a in many different
ways.
This is on the LBC bus, the
keyboard controller.
It does many other tasks,
as it turns out, and
is worth looking closer at,
but being on.
So even though it is on LBC, it
doesn't it doesn't have the capability to
do. It's not DMA.
It cannot initiate DMA requests.
So that's not so bad.
The super IO
has on the other end several ports
and parallel ports, which are
also not so
easy to use against the machine
to use against the system.
There's the boot flash.
There's a debug connector that
isn't exposed inside of the machine.
There's a TPM chip.
And
over on the far end, there's the PMH.
That's another second embedded controller
that does power management things.
And actually that one proves to be quite
helpful.
So that's the upper seabass.
Oh, right. And the super io.
Uh oh, right.
The super Io in the middle.
That's that's
I confused it with the super Io on the
bottom. The super Io in the middle is
actually something we need to look quite
closely at because it puts the LPC
bus all the way down to the bottom of the
screen. This thick line that you see
there is the docking station
interface.
So the fixed line, whatever is on the
south of the on the thicker line
is inside the docking station.
So there's an FBC bus going out to the
docking station as well.
So. Mm hmm.
Let's see, let's start with a
video that was outside
the previous image.
The two interesting the interesting thing
here is the signals on the
far right, the D.C.
clock and data, that's the ice machine
interface that is connected to
the directly to the port and goes
into the chipset, into the kernel driver
just on two pins on the outside of
the machine.
So how can we get
rid of those? Well, the easiest
way seems to be to remove these two
inductance is the twenty one and L 24,
and indeed that works just fine.
I didn't actually try using an external
monitor after having done that
modification.
It might not work or it might
work if one does.
The random trick that we did
that I got some help from the video Angel
with
just before the talk here.
Next thing up
is the
FireWire SD card
and Card Busse
controller.
Unfortunately, that's all in one chip.
So we have to get rid of all of
all three of them at once.
It turns out looking closely
at the block on the left is that
controller chip on the top,
top right, there's a card bust PD,
so a card was powered down.
That sounds good signal
that goes into a
ball that is called hardware.
Suspend for this chip.
Sounds good.
Looking on another page.
This.
Uh, Cardwell's Padoan, it's the second
from the top on this page.
It's connected to our four six one.
So I pull
up resistor holding it
normally active
so that normally the cardboards
is working.
But, uh, well, maybe we can remove that
resistor and connect it to ground
and to that we're permanently
shut down the carbos.
This is the Internet chip it has.
As well, a disabled signal,
third from the top device off,
it's called GBE
Disabled, so we could also remove the
resistor there and.
Connect that to ground tight
ground to permanently disabled the chip,
uh, the Internet chip.
All right. That's all of those.
And how does this look then?
Uh, let's see.
Oh, I should have taken out some
did not do that. Well, uh,
take out all the screws.
From the bottom and on the top
left, the keyboard up,
keyboard comes out, disconnect
the keyboard.
Looks like this now.
Now bend the front a little
bit.
There we go.
The top comes off.
Scalpel time.
So we found this
this super biochip, the LPC
bridge,
it's neatly situated
right next to the battery.
So in the middle of the board,
just make a bit of room and cut up
and cut off the plastic plastic tape
above it.
There we go.
Um, here's a pin out from the datasheet,
which is very easy to to get.
Thankfully,
all the pins that
are labeled D in the beginning,
they go to the docking station.
This this chip is really a docking
station chip.
It's made to do nothing else.
All the ones with the D, they go to the
docking station. So we want to cut those
at the pin at the chip.
Cut those pins at the chip.
Here we go.
Careful.
Um, I hope it's possible
to see, but the painting on the corner
there is is anyway gone and
um, yeah, we do it a few more
times. All the pins with the D.
And a few more pins,
and in the end, we get this,
so, uh.
By cutting the pins, they don't, of
course, come off the PCB, so I have to
take them and clean them off, um,
after cutting them from the chip
so that they don't short in any way and
clean up the piece of be a little bit.
And then we have that
for the docking station.
So that's that's not that's not
so bad.
I managed to destroy one laptop so far,
but. But it's only
one.
If you have a good scalpel and a steady
hand and a good Iroh magnifying glass,
that's that's very doable.
All right, put the tape back on.
Uh, so this is a fully
equipped think padded has
the wireless and the
3G on the bottom right and
a modem.
Let's take.
Well, let's start with the speaker
can trust those
and.
Well, you know, I mean, I don't know.
Right.
A modem who needs that anyway.
Take out some more screws and take out
the Wi-Fi and the 3G card.
Then we need to take off a
display cable,
get the antenna wires
loose and the power
cabling as well.
Which is a little bit tricky because this
is a compact machine, so.
I have to be careful, but it works out
well, the modem connector
we don't care so much about.
Unscrew some screws,
take off some tape for the wireless
antenna.
And finally, we've
gotten oh, right, the hard
drive adapter board as well
needs to come out
finally, the main board is is
free.
Well, for some value of free,
we can take it out of the machine anyway.
Front side, backside side,
there's a microphone.
We'll get to that in a second.
Also, underneath the after much
searching underneath the wireless
cards, this are four six
one was found.
So take off this sheet of protective
tape.
And it's the top
one of the three resistors.
That's our four six one.
It's not labeled on this board,
unfortunately, but it was on another
board.
So take that off.
Clean up a bit.
Todora Wire into place.
The the capacitor right next to it
happens to have a ground
nearby.
So that's convenient.
Put the tape back and
turn the board over.
So that's already cardboards and
FireWire disabled
probably off this protective plastic,
which you have to be careful
if you do because it tends to rip easily.
Right microphone is
soldered into place
between the USB and it was slightly
above the USB and the fiber socket
put the mainboard up on something and
well, he heat disordering
joints until the microphone comes out.
It's not it actually falls out on its own
as long as you encourage it a bit.
But flash.
So the boot flash we want
to reprogram with
our good bios.
For example, with another thing, fun
and a handy clip
and the flash from software,
so this machine had a Micronics
flash chip and
these think pads, there are two different
ones, the Micronics and Syste
that I've seen, MICRONICS one
and win bond as well.
They have a neat feature where
a right protected bit
can actually be set nonvolatile.
So you have to set it only once
and it stays set, whereas the
chip resets this bit every time you boot.
That's not so handy.
So because this was an Micronics
chip, I also saw the
pins three and four together.
Maybe it's possible to see on this
on the chip, the two
rightmost pins on the side that
we can see our bridge together.
The third one is the right protect pin
and the first one is the ground.
So connecting these two together
and having set the right protect
it actually ensures
that the boot flash will not be writable
anymore.
You have to insulter this bridge
in order to reset
or to clear the right protect
in software.
And Sara, in this case, is the
status register, the zero eight zero
means that my slightly patched version of
Flashbang, which always sets this right
protect bit in the flagship,
ran successfully
when putting the mainboard back together.
Be careful with this wireless switch
if you still want to use some kind of
wireless, because the plastic thing that
moves around is kind of sensitive.
It's easy to break the switch off the
mainboard, put
the casing back together,
put the keyboard in.
Put some screws in and power up and
hopefully you see an open
source, Fermor, running on the machine.
Yeah, right.
No, not just yet.
I'm not done just yet.
One minute more. All right.
No, too far.
All right, here we go.
So I wanted to talk a bit about this as
well, the bio's economy, I guess we're
out of time for that.
The bias vendors, they have an excellent
setup where they
sell their product
to the OEM that creates the hardware
design and then
the OEM.
So that's Dell and Lenovo and
whoever they have to
pay license fees to the BIOS
vendor if they want to use
the implementation of the BIOS that
the OEM already implemented.
So given this bias economy,
there are two choices for us.
By a system which
sends money to the biased vendor or by a
system which doesn't send a system, send
money to the biased vendor
and worker, but open source bias
replacement
started in 1999.
A few main boards work really well.
Can we buy it today?
There's there's one popular vendor,
Google, that sells machines
with CORBA on them to
consumers, and that's
the Chromebook,
mostly open Fermor because
on into the machines, on intel systems,
it's actually impossible to have a
completely open firmware at the moment.
AMD is much better,
but there aren't any Chrome books with
AMD processors lock
to cloud services, one might say.
Well,
once you bought the hardware, you can use
it any way you want.
Freescale and all winter arms
look really good.
So
security taking a bit of a jump.
Security starts far,
far, far below the Cryptome
and please make
open firmware a priority, even if
it is really inconvenient to repurpose
a Chromebook.
Thanks to the NGOs, thanks to the
Corbould community, Stefaan Patric's and
all of the guys, thanks to Iran, Philip
Bindman, who made the talk of the head of
Nemesis and thanks to you
for becoming more aware of
what your hardware is doing.